diff --git a/include/spdk/nvmf.h b/include/spdk/nvmf.h
index e8176191e..fdf288fe3 100644
--- a/include/spdk/nvmf.h
+++ b/include/spdk/nvmf.h
@@ -487,8 +487,6 @@ int spdk_nvmf_subsystem_remove_host(struct spdk_nvmf_subsystem *subsystem, const
 /**
  * Set whether a subsystem should allow any host or only hosts in the allowed list.
  *
- * May only be performed on subsystems in the PAUSED or INACTIVE states.
- *
  * \param subsystem Subsystem to modify.
  * \param allow_any_host true to allow any host to connect to this subsystem,
  * or false to enforce the whitelist configured with spdk_nvmf_subsystem_add_host().
diff --git a/lib/nvmf/nvmf_internal.h b/lib/nvmf/nvmf_internal.h
index 9b74edbf6..f20ae924e 100644
--- a/lib/nvmf/nvmf_internal.h
+++ b/lib/nvmf/nvmf_internal.h
@@ -275,7 +275,7 @@ struct spdk_nvmf_subsystem {
 
 	TAILQ_HEAD(, spdk_nvmf_ctrlr)			ctrlrs;
 
-	/* A mutex used to protect the hosts list. Unlike the namespace
+	/* A mutex used to protect the hosts list and allow_any_host flag. Unlike the namespace
 	 * array, this list is not used on the I/O path (it's needed for handling things like
 	 * the CONNECT command), so use a mutex to protect it instead of requiring the subsystem
 	 * state to be paused. This removes the requirement to pause the subsystem when hosts
diff --git a/lib/nvmf/subsystem.c b/lib/nvmf/subsystem.c
index 438824fea..897c06890 100644
--- a/lib/nvmf/subsystem.c
+++ b/lib/nvmf/subsystem.c
@@ -763,12 +763,9 @@ spdk_nvmf_subsystem_remove_host(struct spdk_nvmf_subsystem *subsystem, const cha
 int
 spdk_nvmf_subsystem_set_allow_any_host(struct spdk_nvmf_subsystem *subsystem, bool allow_any_host)
 {
-	if (!(subsystem->state == SPDK_NVMF_SUBSYSTEM_INACTIVE ||
-	      subsystem->state == SPDK_NVMF_SUBSYSTEM_PAUSED)) {
-		return -EAGAIN;
-	}
-
+	pthread_mutex_lock(&subsystem->mutex);
 	subsystem->flags.allow_any_host = allow_any_host;
+	pthread_mutex_unlock(&subsystem->mutex);
 
 	return 0;
 }
@@ -776,7 +773,19 @@ spdk_nvmf_subsystem_set_allow_any_host(struct spdk_nvmf_subsystem *subsystem, bo
 bool
 spdk_nvmf_subsystem_get_allow_any_host(const struct spdk_nvmf_subsystem *subsystem)
 {
-	return subsystem->flags.allow_any_host;
+	bool allow_any_host;
+	struct spdk_nvmf_subsystem *sub;
+
+	/* Technically, taking the mutex modifies data in the subsystem. But the const
+	 * is still important to convey that this doesn't mutate any other data. Cast
+	 * it away to work around this. */
+	sub = (struct spdk_nvmf_subsystem *)subsystem;
+
+	pthread_mutex_lock(&sub->mutex);
+	allow_any_host = sub->flags.allow_any_host;
+	pthread_mutex_unlock(&sub->mutex);
+
+	return allow_any_host;
 }
 
 bool
@@ -788,11 +797,13 @@ spdk_nvmf_subsystem_host_allowed(struct spdk_nvmf_subsystem *subsystem, const ch
 		return false;
 	}
 
+	pthread_mutex_lock(&subsystem->mutex);
+
 	if (subsystem->flags.allow_any_host) {
+		pthread_mutex_unlock(&subsystem->mutex);
 		return true;
 	}
 
-	pthread_mutex_lock(&subsystem->mutex);
 	allowed =  nvmf_subsystem_find_host(subsystem, hostnqn) != NULL;
 	pthread_mutex_unlock(&subsystem->mutex);